Lateral movement risk is now a business continuity problem

At a glance

What this is: This report examines ten enterprise exposure patterns that let lateral movement turn one compromise into business interruption, with broad internal connectivity and weak containment controls emerging as the central risks.

Why it matters: IAM, PAM, NHI, and security architecture teams need to treat containment as a governance problem, because access scope, protocol reachability, and identity boundaries determine how far an attacker can move after initial compromise.

Context

Lateral movement is the stage after initial access where an attacker uses legitimate trust paths, credentials, and internal protocols to reach more systems. In enterprise environments, the problem is not only intrusion, but how the network itself can amplify that intrusion into outage, data exposure, or recovery failure.

Zero Networks frames the issue as a business continuity problem because many organisations optimise for connectivity and operations while leaving containment as an afterthought. That creates a structural gap for IAM, PAM, workload identity, and network segmentation programmes, especially where the same paths that support administration also support attacker pivoting.

Key questions

Q: What breaks when internal admin protocols stay broadly exposed?

A: Broad exposure of RDP, SMB, SSH, WinRM, and similar protocols turns routine administration into attacker mobility. Once a foothold exists, the same trusted channels that support operations can carry lateral movement into more systems than the original compromise should ever touch.

Q: Why does standing privilege increase business continuity risk?

A: Standing privilege lets a compromised identity reuse valid access for far longer than the task that justified it. That creates a wider internal travel path, so one stolen credential can become a multi-system disruption instead of a single account compromise.

Q: What are the signs that containment is failing in practice?

A: Containment is failing when teams cannot quickly isolate a host, revoke a risky path, or explain how far an identity can move laterally. If east-west visibility is weak and recovery depends on manual intervention, the environment is already too open.

Q: How should teams respond when a control plane is reachable from user networks?

A: Move control-plane systems into dedicated management zones and restrict access to tightly governed administrative paths. If user endpoints can reach backup systems, IAM platforms, or orchestration consoles directly, an attacker who gains one workstation can threaten recovery and operations at the same time.

Technical breakdown

Why internal admin protocols become attacker pathways

RDP, SMB, SSH, WinRM, RPC, and related internal protocols are often designed to preserve operational reach, not to constrain trust. When those paths remain broadly reachable, a compromised identity or host can reuse the same management channels that administrators use every day. The security failure is not the protocol itself, but the absence of contextual controls around who may open it, when, and toward what target. In a containment model, the problem is not that east-west traffic exists. The problem is that it is treated as inherently trusted and therefore invisible to governance.

Practical implication: Treat administrative protocols as privileged exposure points and gate them with per-session authorisation, not persistent reachability.

How standing privilege and excessive reachability combine

Standing privilege turns a valid credential into a portable movement path across internal systems. If an identity can authenticate broadly and the network permits broad internal reachability, the attacker does not need to invent a new route. They simply follow the authorised one farther than the organisation intended. This is why identity segmentation matters: access scope is not just about entry to an environment, but about how far an identity can travel after entry. For NHI programmes, the same logic applies to service accounts, orchestration identities, and AI agents with broad connections.

Practical implication: Map where credentials can move laterally, then reduce both permission scope and reachable target sets in tandem.

Why containment readiness is a control, not an outcome

Containment is often discussed as an incident response activity, but the article shows it is an architectural property. If teams cannot quickly revoke risky paths, isolate a host, or narrow internal communication without breaking operations, the environment is already overcommitted to connectivity. That means recovery depends on the very controls that were not designed into the network. The practical lesson is that business continuity and lateral movement defence are the same conversation at different stages: one asks how fast damage spreads, the other asks whether the spread can be stopped before critical systems are affected.

Practical implication: Build isolation and revocation capability into the network design before an incident tests whether containment is possible.

Threat narrative

Attacker objective: The objective is to convert one initial compromise into broad internal access that can disrupt operations, increase blast radius, and undermine recovery.

1. Entry occurs when an attacker compromises a host, identity, or workload that already has internal trust relationships and administrative reach.
2. Credential abuse follows when the compromised identity can authenticate through common internal protocols or overprivileged service access.
3. Escalation happens as the attacker reuses those internal paths to pivot toward control-plane systems, backup systems, or other high-value assets.
4. Impact is realised when the attacker reaches enough systems to disrupt operations, impede recovery, or widen the blast radius into a business outage.

Breaches seen in the wild

• Storm-2949 Azure Breach: Storm-2949 social engineering attack turns one cloud identity compromise into full Azure tenant breach.
• AI LLM hijack breach: attackers used stolen AWS access keys to hijack Anthropic LLM models on Bedrock.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Blast radius, not perimeter hardness, is the decisive variable in modern enterprise defence: this report shows that once an attacker is inside, the size of the reachable internal graph matters more than whether the initial intrusion was blocked. Networks built for connectivity inherit a structural weakness when they do not distinguish operational trust from adversary mobility. Practitioners should treat containment scope as a core security control, not a secondary response concern.

Standing privilege is the governance failure that turns routine administration into business disruption: if an identity can authenticate broadly and stay authorised indefinitely, lateral movement becomes an expected property of the environment rather than an exceptional attack. This applies across human admins, service accounts, and AI agents with persistent connections. The implication is that identity scope must be judged by lateral reach, not just by login success.

Closed-by-default internal access is the named control pattern this report points toward: administrative pathways should be opened on demand, tied to session context, and withdrawn as soon as the task is complete. That is especially relevant where broad east-west trust, control-plane exposure, or workload-to-workload permissions currently operate as standing assumptions. The practical conclusion is simple: if an attacker can move like an administrator, containment has already failed.

AI agent connectivity creates a new form of lateral movement exposure debt: when agents hold broad standing access across email, databases, cloud APIs, and code repositories, a compromised agent can become the fastest path through the enterprise. That is not just an AI governance issue, it is an identity boundary issue because the agent inherits the trust graph attached to its permissions. Practitioners need to evaluate agent access as an internal movement surface, not as a standalone automation layer.

Identity segmentation must now be measured by reachable systems, not by account inventory: the article makes clear that counting identities or privileges is insufficient if a single compromised endpoint can still reach most of the environment. The governance question has shifted from who has access to how far that access can travel. Security teams should therefore prioritise network and identity boundaries together, because either one on its own leaves the blast radius intact.

From our research library:

• 82% of detections were malware-free, with attackers using valid credentials and trusted tools, according to CrowdStrike's 2026 Global Threat Report.

What this signals

Containment is now an identity governance issue as much as a network design issue: if internal reachability is broad, least privilege exists only on paper. Security leaders should assess whether humans, service accounts, and agents can be constrained by the same governance logic without leaving privileged side doors open.

Identity blast radius is the right concept for this problem: it describes how far a compromised identity can travel before a defender can intervene. That framing helps teams move beyond account inventory and focus on reachable systems, control-plane adjacency, and the internal trust graph that actually determines impact.

For practitioners

• Close internal admin protocols by default Require per-session authorisation and MFA before opening RDP, SMB, SSH, WinRM, RPC, or similar management paths, then close them again when the task ends.
• Scope every identity to least-privilege reachability Review which internal systems each human admin, service account, workload, or agent can actually reach, then remove broad east-west permissions that are not essential for the role.
• Isolate control-plane systems from routine user paths Place Active Directory, IAM, backup infrastructure, hypervisors, Kubernetes controllers, and cloud management consoles in dedicated management zones with restricted admin access.
• Instrument identity-attributed east-west logging Tie internal traffic visibility to specific identities, not only to IPs or ports, so you can reconstruct lateral movement and spot unusual internal traversal before it reaches crown jewels.
• Design containment playbooks for fast isolation Predefine how to quarantine a compromised host, revoke risky paths, and preserve operational continuity without waiting for a full incident response cycle to complete.

Key takeaways

• The report shows that the real danger is not only initial compromise, but the ability to translate one foothold into broad internal movement.
• Evidence from enterprise environments points to pervasive internal reachability, standing privilege, and control-plane exposure as the main enablers of that movement.
• Practitioners should treat containment, identity scope, and east-west segmentation as linked controls if they want to protect continuity.

Key terms

• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Containment: The phase of incident response that stops an incident from spreading while preserving the evidence needed to investigate it. In cloud environments, containment often starts with identity revocation, isolation of workloads, and protection of logs before any system is terminated or cleaned up.
• Identity Segmentation: The practice of separating identities by workload, environment, and risk so one credential cannot easily move across unrelated systems. For machine identities, segmentation is a blast-radius control as much as a least-privilege measure, because shared dependencies can turn a single compromise into a wider operational event.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.